View RSS Feed


LTE attach procedure

Rating: 2 votes, 4.50 average.
Let us discuss the LTE attach procedure in detail.

In LTE, UE needs to register to network in order to start data services after power on. This procedure is called an attach procedure. In very short UE perform below tasks to perform attach.
Camp on to best available cell, PSS and SSS synchronization for radio frame timing alignment, RRC connection establishment, Identification and authentication, location update, Session create request, activating default EPS bearer and UE capability info exchange.
Now we will see all of these procedures in detail.

After being power on, UE tunes RF and search available freq from the given possible EARFCN it can support and rank those based on signal strength. UE then look for PSS and SSS to be synchronized on sub-frame level and obtain physical cell ID.
Once UE knows PCI, it also knows cell specific reference signals which are used for channel estimation, cell selection/reselection and handover.
RRC connection establishment:
RRC connection establishment.png

Now UE picks one of the 64 preambles in an LTE cell and send rach message to eNodeB with RA-RNTI. eNodeB respond to this by providing T-CRNTI, uplink resource grant and timing advance adjustment value. UE then send “RRC connection Request” using CRNTI and UE identity (mostly S-TMSI) along with establishment cause.
eNodeB responds with RRC connection setup message with UL parameters like UL-SCH, PHR and UL power control. Then UE sends RRC connection setup complete which also carries NAS message “Attach Request”. The attach message contains the old GUTI (Globally Unique Temporary Identifier).
Attach Request.png

Attach Request:
eNodeB identifies MME from old GUMMEI reported by UE and send "Attach Request" embedded in the Initial UE Message. The message also includes the PDN Connectivity Request message. The Tracking Area Identify (TAI) and E-UTRAN Cell Global Identifier (ECGI) are also included.
PDN Connectivity Request, which asks the network to establish a default EPS bearer. The message includes a PDN type, which indicates whether the mobile supports IPv4, IPv6 or both.

Attach Request.png
-UTRAN Cell Global Identifier (ECGI).jpg

Since the UE identified itself with GUTI and the MME has changed since detach, the new MME uses the GUTI received from the UE to derive the old MME, and send an identification Request (old GUTI, complete Attach Request message) to the old MME to request the IMSI.

If mobile is unknown to MME than MME will ask UE to send IMSI using EMM Identity Request.
Authentication and Identification:
In authentication and key agreement, the mobile and network confirm each other’s identities and set up a new set of security keys. In NASsecurityactivation, the MME activates those keys and initiates the secure protection of all subsequent EMM and ESM messages.
Then Authentication will be performed between UE and HSS using IMSI, unused EPS Authentication Vectors, KSIASME, KASME. After authentication, NAS security activation will be performed where MME activates those keys and initiates the secure protection of all subsequent EMM and ESM messages.

Authentication and Identification.png

New MME sends the mobile’s IMSI to the home subscriber server (HSS), in a Diameter Update Location Request. HSS will ask old MME to forgot about UE's context and EPS bearer.
HSS sends an Update Location Answer to the new MME, which includes the user’s subscription data. The subscription data list all the access point names (APNs) that the user has subscribed to and define each one using an APN configuration.
MME will select preferred/default APN for UE and send GTP-C Create Session Request. It also sends mobile's IMSI, destination PGW and UE subscription data. Now PGW allocate IP address to UE and runs IP connectivity access network (IP-CAN) session establishment procedure.
PGW respond to SGW with UE IP address, QoS of default bearer and SGW forward it to MME.
PGW respond to SGW with UE IP address.png
PGW respond to SGW with UE IP address1.jpg

Create session Request:
MME initiates ESM I88procedure called “Default EPS bearer context activation" also known as "Activate Default EPS Bearer Context Request". This procedure tells the base station to set up an S1 signaling connection for the mobile, and S1 and radio bearers that correspond to the default EPS bearer.
eNodeB now activates AS security with UE to secure data flow.
eNodeB will send RRC connection reconfiguration to UE and set up default EPS bearer. UE will send RRC conn Reconfig complete which triggers S1-AP Initial Context Setup Response. The mobile then composes an ESM Activate Default EPS Bearer Context Accept and embeds it into an EMM Attach Complete.
eNodeB will ask UE for capabilities and UE responds with its capability and the same will be conveyed to MME. UE can now send the uplink data however SGW need to know identity of selected base station. To do that MME will send SGW a "Modify bearer request".

Submit "LTE attach procedure" to Digg Submit "LTE attach procedure" to Submit "LTE attach procedure" to StumbleUpon Submit "LTE attach procedure" to Google

Tags: None Add / Edit Tags


  1. lucian's Avatar
    Exelente buen trabajo por favor ponerar la fuente y mejorar las imagenes
  2. budiprast007's Avatar